The present invention relates to the field of real-time network fault and performance management systems, and more particularly to a knowledge-based method of parsing alarm, status, performance and other event messages generated by active elements of managed networks.
Modern networks, including fixed, wireless, telecommunication and enterprise networks, are complex dynamic systems that often have thousands of interconnected active elements, such as switches, digital cross-connects, routers, bridges, environmental devices, and power systems. Tens to hundreds of events (messages) per second pass the communication trunks connecting the elements. To monitor the status of networks, perform fault root cause analysis, aggregate messages, and generate trouble tickets, all of the messages generated by active network elements need to be parsed and analyzed.
However, current methods of message parsing are rigid. They are based exclusively on hardcoded parsing and generation algorithms. Any change in the message processing algorithms requires re-programming and compilation of the full message-processing module. This hampers the efficiency of constructing and supporting the message parsing components of network management systems for a variety of reasons.
Networks contain a large variety of active network elements produced by different vendors. The messages generated by the active elements of different vendors are incompatible syntactically and inconsistent semantically. That is, current message processing algorithms require reprogramming and compilation for each of the many message types. However, network operations personnel are not, in general, experienced programmers capable of building parsers. Therefore, they are not able to customize the parsing process to the specifics of managed networks. Furthermore, the rigidity of current methods, and hence lack of interoperability with various active network elements, is not compliant with the open architecture of distributed network management, which stresses interoperability among various elements.
Systems and methods consistent with the present invention accomplish these needs by supplying a universal parsing service that operates over various levels of message classes. The parsing service also provides a graphical user interface (GUI) editing tool that allows developers to define message class objects. Systems and methods consistent with the present invention also provide a declarative message parsing knowledge structure allowing customization of the parsing service from the messages of different active network elements (NEs) in a correlation network environment.
In accordance with one aspect of the present invention, as embodied and broadly described herein a system for parsing network messages comprising a parser knowledge structure comprising a hierarchal graph of message classes, wherein each message class parses a portion of the message, and a universal parsing procedure means for driving the parser knowledge structure. In another embodiment the system may further comprise the hierarchal graph of message classes includes a root node and at least one terminal node, and the universal parsing procedure means comprises instructions on how to traverse the hierarchy of message classes from the root node to the terminal node, wherein the message is completely parsed after reaching the terminal node.
In accordance with another aspect of the present invention, as embodied and broadly described herein a method for parsing messages in a distributed-component network management system, the method performed by a universal parsing procedure means, comprising receiving a raw message from the distributed-component network management system, parsing the raw message by traversing a parser knowledge structure comprising a hierarchal graph of message classes from a root node to a terminal node, wherein each message class parses a portion of the message and the message is completely parsed when a terminal node is reached, and providing the parsed message to the notification service.
In accordance with yet another aspect of the present invention, as embodied and broadly described herein a computer readable medium including computer-executable instructions for a universal parsing procedure means to perform a method comprising the steps of receiving a raw message from a notification service, parsing the raw message by traversing a parser structure comprising a hierarchal graph of message classes from a root node to a terminal node, wherein each message class parses a portion of the message and the message is completely parsed when a terminal node is reached, and providing the parsed message to the notification service.
In accordance with yet another aspect of the present invention, as embodied and broadly described herein a computer readable medium including computer-executable instructions for a message class in a parsing knowledge structure comprising a hierarchal graph of message classes having a root node and at least one terminal node to perform a method comprising the steps of retrieving a message, determining whether a pattern string of a message class matches the message, parsing a portion of the message corresponding to the pattern string if the pattern string matches the message, and saving a remaining portion of the message to be parsed in a predetermined location.
The summary and the following detailed description should not restrict the scope of the claimed invention. The accompanying drawings, which form part of the detailed description, shown one embodiment of the invention and, together with the description, explain the principles of the invention.